Trezor's blog (10 September 2026) says that on 9 September 2026 Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts, and an unauthorised actor used Brevo's system to send emails from various customer accounts, including Trezor's. Trezor says the incident affected its opt-in newsletter database of roughly 347,000 email addresses, that no other Trezor system was touched, and that it suspended the Brevo account. The phishing email, subject “Critical Security Alert: STM32 Entropy Vulnerability”, contained a link that prompted users to download an app asking for their wallet backup. Trezor says it took the domain down at the DNS level within 20 minutes, limiting access to 2,500 people who had clicked before the takedown, and contacted all 347,000 recipients. According to BleepingComputer (11 September 2026), the fake alerts came from help@trezor.io and claimed that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used in Trezor wallets could expose seeds to brute-force cracking. Trezor's advice: anyone who entered a wallet backup through such a link should immediately move their funds to a new wallet; Trezor will never ask for a wallet backup. This is a different incident from Brevo's 14 September Cloudflare Worker ClickFix compromise (separate card). (source: Trezor blog) Updated 17 Sep 2026: Trezor's post now says Brevo confirmed that 347,149 marketing email contacts were exported from Trezor's list through the API during the incident. (source: Trezor blog, trezor.io) Correction (25 Oct 2026): the card date has moved from 11 to 10 September 2026, the date of Trezor's blog post, which gives a date but no time; BleepingComputer's report is dated 11 September. (source: Trezor blog, trezor.io) Correction (28 Oct 2026): removed a US Eastern and Perth time given for BleepingComputer's report, which shows its time with no time zone; the card date stays 10 September. (source: BleepingComputer)
Trezor blog — Security incident at Brevo, our third-party email provider (10 Sep 2026; updated 17 Sep 2026)
The Australian registered charity Way Forward, which supports people in financial hardship, has disclosed that its payment systems have been suspended following a third-party cyber incident, Cyber Daily reported on 10 September 2026. “We have become aware of a cyber incident relating to an external provider we use for our customer management platform,” the charity said in a 9 September statement. (source: Cyber Daily) Correction (31 Oct 2026): removed material from the login-only part of Cyber Daily's report and a time taken from page metadata; the card now carries only what the readable part states. (source: Cyber Daily)
ABC News (10 September 2026) reports a Downing Centre Local Court hearing for Christopher John Duff, 40, who has pleaded not guilty to four counts of accessing restricted data held in a computer. NSW Department of Communities and Justice discovered a breach of the NSW Online Registry (court-user login portal) in March 2025; police say cybercrime detectives investigated alleged unauthorised access to 8,769 restricted documents between January and March 2025 (AVOs, details of minors, and other DCJ forms). Prosecutors allege Duff used ChatGPT to create Python scraper-style scripts for bulk download, then sought legal advice and “coaching” from ChatGPT after his registry login was shut down and before charge — and intend to rely on ChatGPT conversation records plus forensic testimony in what is described as among the first such Australian cases. Hearing stalled on volume (~10,000+ pages of proposed exhibits). Charged April 2025 after a search warrant in Sydney’s east; on bail. Allegations unproven. (sources: ABC; ACS Information Age)
Group-IB (9 September 2026) documents a Gigabud (GoldFactory) banking-trojan chain that installs a second Android app, Vwork, to create a work profile and drop a tampered banking app inside it. Work-profile isolation hides the trojan from the banking app’s malware checks on the personal profile. Confirmed on infected devices in Indonesia. Gigabud arrives as a sideloaded fake airline/tax/government app, demands Accessibility and overlay permissions, overlays fake logins and lock-screen capture, then drives taps via Accessibility under a black screen. Vwork is based on open-source Shelter but strips caller checks so other apps can create profiles, clone apps, and open them; setup is reduced to a single Chinese-language prompt. Order observed: Gigabud → Vwork within minutes → cloned banking app. (source: Group-IB) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Group-IB)
Surfshark's 9 September 2026 incident report says unusual activity on an internal engineering test server was confirmed on 2 September 2026 after a human misconfiguration left the host reachable from the internet. The company contained the same day and finished remediation by 5 September. An unauthorised party accessed limited engineering material (parts of system binaries, internal service configurations, and some build-related credentials that had appeared in code history). Access was also gained to an isolated content-accessibility optimisation VPS used as a proxy with no user identities, IP addresses, encryption keys, or browsing traffic. Surfshark states no user data or production VPN services were affected, no customer action is required, and exposed secrets were rotated or retired. (sources: Surfshark blog incident report; BleepingComputer) Updated 10 Sep 2026 (BleepingComputer): BleepingComputer's report is dated 10 September 2026; details credited to BleepingComputer on this card come from that report.
US Treasury OFAC (press release sb0624) designated Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related crime targeting Americans, plus two supporting digital-currency entities — coordinated with DoJ Scam Center Strike Force infrastructure and wallet seizures. Xinbi acted as escrow between scam-center operators and vendors (pig-butchering sites, laundering, trafficking labour). Treasury notes reported use by North Korean hackers and OFAC-designated entities including Jin Bei Group and Prince Group TCO affiliates. (source: Treasury OFAC) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: US Treasury)
Proofpoint (9 September 2026) documents BlueMoon, chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 sandbox escape; patch-gap 0-day), and CVE-2026-85880 (Windows ALPC heap overflow LPE / AppContainer escape; Microsoft September Patch Tuesday + CISA KEV). First in-the-wild use attributed to China-aligned APT31 (Proofpoint: TA412, aka JungleBamboo / Violet Typhoon) from 28 August 2026; other espionage clusters rapidly reused the kit. UPDATE 15 September 2026 (Volexity blog 9 Sep): Volexity details two China-nexus clusters using the same byte-identical exploit chain against NGOs via spearphishing through reflected XSS on a legitimate US university site. UTA0560 deploys GRIMWEDGE (obfuscated JavaScript backdoor via MSI custom actions; C2 ocr.opusaccel[.]top). JungleBamboo/APT31 deploys SUPERSTOMP loader then LONGTALE (aka GemStone) credential-stealing Chrome extension. UPDATE 23 September 2026 (Volexity Part 2 blog 21 Sep): third China-nexus cluster UTA0565 used the same BlueMoon chain on 3–4 Sep 2026 via multiple fake websites (chinadigitaltimes[.]top; americanprgoress[.]top typosquat of Center for American Progress) with hidden iframe loading config.html; final payload chrome_cleanup.exe is previously undocumented CLEANGULP (MSVC; control-flow flattening). CLEANGULP installs to %LOCALAPPDATA%/Microsoft/IME/MicrosoftIME.exe with scheduled task “MicrosoftIME”; commands shell/ps/upload/download/bof; C2 thecovnresation[.]com over HTTP (AES-256-GCM + custom Base64 alphabet). Targeting included Asian government entities (Hong Kong activist lure) and CAP-themed phishing. (sources: Volexity Part 2; Proofpoint) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Volexity; Microsoft; Proofpoint)
Volexity — Mind the (Patch) Gap, Part 2 / UTA0565 CLEANGULP (21 Sep 2026)
BleepingComputer (9 September 2026) covers Veradigm's SEC disclosure of a third-party vendor incident: an attacker obtained vendor credentials for a Veradigm customer-services API and copied patient personal details including some Social Security numbers; clinical/medical content and the broader Veradigm network were not accessed per the filing. Veradigm says a small number of customers were affected, notified law enforcement, and is offering credit monitoring where applicable. According to BleepingComputer, Veradigm's disclosure did not identify the attacker; The Gentlemen ransomware group claimed the intrusion on 5 September. (source: BleepingComputer) Updated 24 Oct 2026: the gang's claimed record count has been taken out of the headline and the unverified claimed leak deadline removed. (source: BleepingComputer) Correction (25 Oct 2026): removed the ransomware group's own claim to be holding 3.5 million patient records; no company, regulator or outlet has confirmed that figure. (source: BleepingComputer)
BleepingComputer (9 September 2026) reports AdaptHealth confirmed about 4.1 million people were exposed in a cyberattack discovered in July. SEC filing 2 July 2026 disclosed access to cloud business apps including patient management, document storage, and EHR portals. Company update: compromise on 5 June 2026 via social engineering of a third-party contractor's privileged account; an unnamed threat actor demanded a ransom on 15 June in exchange for not leaking the stolen data; data classes named include names, contact and demographic data, health insurance, and health information. HHS submission lists 4,115,802 individuals. Notifications and 12-month credit monitoring offered. No Australian nexus identified this pass. (source: BleepingComputer) Correction (24 Oct 2026): Removed the ShinyHunters attribution: BleepingComputer says it rested on the group listing AdaptHealth on its leak site (as reported by HIPAA Journal), which is not independent confirmation; AdaptHealth refers only to an unnamed threat actor. (source: BleepingComputer)
Sharp Office, a Hunter Region office technology specialist, has confirmed it is investigating a cyber incident, according to Cyber Daily (9 September 2026). The Gentlemen claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states, and its date moved to 9 Sep 2026, the date of Cyber Daily's report. (source: Cyber Daily)
Cyber Daily — The Gentlemen strikes Sharp Office as company confirms incident investigation (9 Sep 2026)
SOCRadar (8 September 2026, 13:00 Turkey time; 6:00 pm Perth) reports active exploitation of CVE-2025-25249, a heap-based buffer overflow in the FortiOS / FortiSwitchManager cw_acd CAPWAP daemon (UDP 5246), delivering PivotC2 — a Node.js post-exploitation RAT for FortiGate with interactive shell, tunnelling, scanning and config/credential harvesting. SOCRadar cites NVD's CVSS 3.1 score of 9.8. Per SOCRadar: exploitation since at least July 2026; more than 30,000 IP addresses targeted and 178 of them confirmed exploited and infected with PivotC2, with the highest concentration in the US, where two full intrusions resulted in confirmed data exfiltration; tradecraft assessed with high confidence as Russian-speaking cybercrime; the actor highly likely used AI to develop the RAT. Affected per SOCRadar: FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17 and all 6.4 versions; FortiSwitchManager 7.2.0–7.2.6 and 7.0.0–7.0.5. Fixed: FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18; FortiSwitchManager 7.2.7 / 7.0.6. Fortinet's advisory FG-IR-25-084 (published 13 January 2026, updated 23 February 2026) lists the same affected and fixed versions, tells FortiOS 6.4 users to migrate to a fixed release, and rates the flaw CVSSv3 8.1 (High); Fortinet's CVE record uses high attack complexity (AC:H), lower than NVD's 9.8. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 9 September 2026 (per NVD and the CVE record). (sources: SOCRadar; Fortinet advisory FG-IR-25-084; NVD; Fortinet) Correction (26 Oct 2026): removed the SecurityWeek credit and link; every fact is now credited to SOCRadar, NVD or Fortinet's CVE record, and FortiOS 6.4 has been added to the affected versions. The card date has moved from 10 to 8 September 2026, the Perth date of SOCRadar's report (8 September, 10:00 UTC; 6:00 pm Perth time (AWST)), the earliest report of this exploitation cited. (source: SOCRadar) Correction (26 Oct 2026): affected versions, fixed versions and Fortinet's CVSSv3 8.1 rating are now cited directly to Fortinet's advisory FG-IR-25-084. (source: Fortinet)
Sophos analysis (reported by BleepingComputer on 8 September 2026) describes malware on compromised F5 BIG-IP Access Policy Manager appliances that injects a PHP web shell into memory when Apache loads APM webtop scripts apm_css.php3, full_wt.php3 or webtop_popup_css.php3 — so on-disk file hashes can look clean. F5 previously tracked related activity as malware family c05d5254 and warned those three scripts can be modified or hold in-memory-only shells (IoC list from March). Defenders must not rely on disk-only webshell scans; compare runtime/Apache memory and hunt the F5 IoCs. Sophos says F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated remote code execution flaw. (source: Sophos) BleepingComputer (8 September 2026) adds that ESET tracks the malware as PoisonedRefresh; that its installer infects Apache's /usr/sbin/httpd binary, modifies SELinux and persists across BIG-IP upgrade images; that the second stage hides strings with RC4 and hooks __libc_start_main and apr_dso_load; that CVE-2025-53521 is a critical RCE flaw F5 reclassified from a denial-of-service issue in March; and that the Shadowserver Foundation reported 795 exposed endpoints the day before its report. BleepingComputer lists hunting signals from Sophos: Apache workers reading /proc/self/maps, creating /run/bigtlog.pipe or launching /bin/bash, unusual POSTs to the targeted .php3 paths, and HTTP 201 responses served as text/css. (source: BleepingComputer) Correction (27 Oct 2026): a second card on the same Sophos research (PoisonedRefresh, 8 September) has been merged into this one and removed. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 7 to 8 September 2026, the date of BleepingComputer's report; Sophos's post shows no visible date. (source: BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Sophos; BleepingComputer)
Sophos — in-memory PHP web server rootkit (BIG-IP APM)
